Keeper Security has urged schools, colleges and universities to strengthen their cyber defences ahead of the new academic year, warning that AI-powered phishing and a growing number of unmanaged machine identities are widening the education sector’s attack surface.
The identity security and privileged access management (PAM) provider said the annual rush to provision accounts, issue credentials and connect new devices creates a particularly attractive window for cybercriminals.
At the start of an academic year, IT teams can be responsible for onboarding thousands of students, faculty and staff while simultaneously enrolling devices and integrating third-party applications. Keeper warned that this combination can increase the likelihood of misconfigurations, stale credentials and excessive access going unnoticed.
Education institutions are already frequent targets for ransomware, credential theft and data breaches, in part because of the valuable information they hold, ranging from student and financial records to academic research.
Keeper said the threat is being compounded by relatively low levels of security awareness. Its research found that just 14% of schools mandate security awareness training, while almost one in five students and parents reported reusing passwords across personal and school accounts.
Artificial intelligence is adding another layer to the problem. AI-generated phishing messages can imitate communications from IT helpdesks, student funding departments and senior university figures with greater accuracy, potentially removing many of the spelling, grammar and formatting mistakes traditionally associated with phishing campaigns.
Deepfake technology also gives attackers the ability to impersonate trusted individuals through voice and video.
According to Keeper research, 52% of education leaders identify deepfake impersonation as a major concern, but only 26% are confident in their ability to recognise AI-enabled threats. The company also found that 41% of institutions reported being targeted by AI-generated phishing attempts or misinformation campaigns.
Beyond attacks targeting students and staff, Keeper highlighted what it describes as a less visible threat to education environments: non-human identities (NHIs).
These identities include service accounts used to synchronise student information and learning management systems, API keys connecting third-party EdTech applications, machine certificates authenticating connected equipment and cloud identities supporting automated workloads.
Increasingly, the category also includes AI agents and bots used for functions such as admissions, IT helpdesks and grading.
Keeper warned that credentials associated with these systems can be overlooked by conventional identity management practices. Service account passwords may remain unchanged for long periods, while API tokens belonging to applications that are no longer used can potentially remain active.
Cloud workloads can similarly accumulate permissions beyond those required for their function, while expired or incorrectly configured certificates can create additional security gaps.
Darren Guccione, CEO and co-founder of Keeper Security, said the education sector needed to broaden its approach to identity security.
“The conversation about education cybersecurity has historically focused on human accounts: students, teachers and administrators,” said Guccione. “But the real blind spot is the vast ecosystem of machine identities that power modern EdTech. Back-to-school is the right moment for education IT teams to take stock of every identity on their network, human and non-human alike.”
Keeper is recommending that education IT teams use the period before students return to review both human and machine access to their environments.
Among its recommendations is enforcing multi-factor authentication (MFA) across student, faculty and staff accounts, alongside deploying enterprise password management to reduce weak, reused and shared credentials.
Institutions should also audit privileged access and remove permissions associated with former employees, expired service accounts and applications that are no longer required, the company said.
For non-human identities, Keeper recommends creating an inventory covering service accounts, API keys, machine certificates, cloud identities and AI agents. Credential rotation policies should then be established, particularly for third-party EdTech integrations and AI systems introduced for the coming academic year.
The company also advised institutions to update phishing awareness programmes to account for increasingly convincing AI-generated communications.
Keeper said its zero-trust and zero-knowledge security platform can be used to discover, govern and rotate credentials belonging to both human and non-human identities. Its KeeperPAM platform additionally provides privileged access controls, session recording and audit capabilities.
As education environments become increasingly dependent on cloud services, connected equipment, third-party applications and AI, Keeper argues that knowing which identities have access (and whether they still require it) is becoming as important as protecting the students and staff behind traditional user accounts.
